路径： VirusScan Enterprise > Access Protection Policies
Port blocking rules
| Process | <|
| Port | 80 |
| Direction | Outbound |
| Action | Report |
| Rule name | Powershell HTTP remote session |
| Process | <|
| File | C:WindowsSys* |
| File actions | Files being executed |
| Action | Block, Report |
| Rule name | Word cmd execution |
| Process | <|
| File | C:WindowsSys* |
| File actions | Files being executed |
| Action | Report |
| Rule name | Excel cmd execution |
| Process | <|
| File | C:WindowsSys* |
| File actions | Files being executed |
| Action | Block, Report |
| Rule name | Word powershell execution |
| Process | <|
| File | C:WindowsSys* |
| File actions | Files being executed |
| Action | Block, Report |
| Rule name | Excel powershell execution |
| Process | <|
| File | C:UsersPublic*.exe |
| File actions | New files being created, Files being executed |
| Action | Block, Report |
| Rule name | Powershell emotet launcher |
| Process | * |
| File | C:Users*AppData*.exe |
| File actions | New files being created, Files being executed |
| Action | Block, Report |
| Rule name | AppData File Execution |
| Process | * |
| File | < |
| File actions | New files being created, Files being executed |
| Action | Block, Report |
| Rule name | Tor process launched |
| Process | <|
| File | C:Users*AppData* |
| File actions | Files being executed |
| Action | Block, Report |
| Rule name | rundll32 AppData file execution |
| Process | <|
| File | C:Windows |
| File actions | Files being executed |
| Action | Block, Report |
| Rule name | Word certutil execution |
| Process | <|
| File | C:Windows |
| File actions | Files being executed |
| Action | Block, Report |
| Rule name | Excel certutil execution |
| Process | <|
| File | *.sct* |
| File actions | Files being executed |
| Action | Block, Report |
| Rule name | Regsvr32 sct file execution |
| Process | <|
| File | *.hta* |
| File actions | Files being executed |
| Action | Block, Report |
| File name | hta file execution |
| Process | * |
| Key | HKLM/Software/Microsoft/Windows/CurrentVersion/Run |
| Reg actions | Create key or value |
| Action | Report |
| Rule name | HKLM Persistence |
| Process | * |
| Key | HKCU/Software/Microsoft/Windows/CurrentVersion/Run |
| Reg actions | Create key or value |
| Action | Report |
| Rule name | HKCU Persistence |
转载于:.html
本文发布于:2024-02-03 07:01:59，感谢您对本站的认可！
本文链接：https://www.4u4v.net/it/170691491949404.html
版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系，我们将在24小时内删除。
| 留言与评论（共有 0 条评论） |
